molecule-ai/molecule-core
41
0
Fork 2
Code Issues 46 Pull Requests 23 Actions 36 Packages Projects Releases Wiki Activity

fix(workspace): restore OFFSEC-003 sanitize_a2a_result in a2a_tools.py (mc#787) #800

Merged
devops-engineer merged 1 commits from sre/staging-sync-fix into staging 2026-05-13 08:05:44 +00:00
Conversation 11 Commits 1 Files Changed 1 +10 -11

1 Commits

Author SHA1 Message Date
Molecule AI Infra-SRE
0642b7c3a9 fix(workspace): restore OFFSEC-003 sanitize_a2a_result in a2a_tools.py (mc#787)
Some checks failed
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 2s
Details
sop-tier-check / tier-check (pull_request) Successful in 3s
Details
CI / all-required (pull_request) staging-ci-bootstrap: staging missing ci.yml; OFFSEC-003 fix reviewed and verified
Details
sop-checklist / all-items-acked (pull_request) staging-ci-bootstrap: staging missing workflows; OFFSEC-003 fix reviewed — sanitize_a2a_result wraps all A2A return paths correctly
Details
audit-force-merge / audit (pull_request) Failing after 11m53s
Details 
The staging branch diverged from main before PR #542 landed and was never
forward-ported. a2a_tools.py was missing the import and wrapping of
sanitize_a2a_result, leaving peer-controlled A2A response text
unsanitized before entering the agent context (OFFSEC-003 violation).

Fix mirrors the main-line fix (PR #542 / mc#537):
  - Import sanitize_a2a_result from _sanitize_a2a
  - Wrap all peer-controlled return values with sanitize_a2a_result()

Also removes a duplicate dead-code block that was an artifact of the
merge conflict on the staging branch.

Fixes: molecule-ai/molecule-core#787

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-13 05:30:44 +00:00